Treasury Committee
Oral evidence: The work of the Payment Systems Regulator, HC 212
Tuesday 30 January 2024
Ordered by the House of Commons to be published on 30 January 2024.
Members present: Harriett Baldwin (Chair); Dr Thérèse Coffey; Dame Angela Eagle; Stephen Hammond; Keir Mather; Anne Marie Morris.
Questions 168 - 251
Witnesses
I: Chris Hemsley, Managing Director, Payment Systems Regulator, and Aidene Walsh, Chair, Payment Systems Regulator.
Examination of witnesses
Witnesses: Chris Hemsley and Aidene Walsh.
Q168 Chair: Good morning and welcome to this Treasury Committee session on the work of the Payment Systems Regulator. Could I start by inviting you to introduce yourself, Aidene?
Aidene Walsh: I am the chair of the Payment Systems Regulator.
Chair: Thank you, and Chris?
Chris Hemsley: I am the managing director of the Payment Systems Regulator.
Q169 Chair: Thank you very much. It is good to see you in January. We were keen to have you in early in the year, because obviously this is a big year for what you are doing in your work. Authorised push payment fraud, which is the bane of so many of our constituents’ lives, is something you are very committed to tackling and, through the legislation last year, are now required to implement. We have heard you have set a date of 7 October for full implementation. Can you reassure the Committee that is going to go ahead as planned on 7 October?
Q170 Aidene Walsh: I will give you that reassurance that we have looked at all the evidence and we are committed to the 7 October date.
Q171 Chair: Everything is going to be ready by 7 October from a systems and implementation point of view, so our constituents can feel confident that, from that date, this authorised push payment fraud is going to be something they will be automatically reimbursed from?
Aidene Walsh: Let me start and then I will hand over to Chris. The infrastructure will be in place in order to support that. Chris and the team are working very closely with all the participants in the payment system to ensure they understand their obligations. We have set the date, so from a compliance perspective, the team, as I said, are working very closely. Clearly, there may be some who are not ready, but that will be dealt with in a different manner.
Chris Hemsley: That is exactly right. There is a lot of work to do. I know many firms need to prepare for that go-live date, and there are some central systems that are in the process of being procured and delivered. But, as Aidene said, we have a team ready and they will be monitoring and escalating issues if there are firms that are unable to comply.
Q172 Chair: It sounds like you have a project plan between now and 7 October. Can you list what the major deliverables are that you still do not have but that you will have by 7 October?
Chris Hemsley: The main one I would call out is that there is a need for a central system that is essentially like a case management system, which needs to be adapted and delivered before 7 October. What that will do is allow the necessary communication between the sending firm, the act of reimbursement, and then sending that information to the receiving firm; so there is a need for communication between parties. That is the key system that needs to be delivered and implemented on time. Then of course the firms themselves—and this will be different for different firms, some are in a pretty good place now and some have further to go—will need to have their own systems in place to deal with phone calls, deal with case management, and, frankly, deal with customers.
Q173 Chair: There is a whole computer system that still needs to be built, is that what I am hearing?
Chris Hemsley: It is in the process of being procured right now.
Q174 Chair: You have not even procured it yet?
Chris Hemsley: Pay.UK is well advanced in that procurement and within the next few weeks should be announcing the supplier of that system. It is not designing a payment system; it is designing a particular service to share information. It is important, but I do not want to give the Committee the impression that there is the need for a new all-singing, all-dancing payment system. That is not the case.
Q175 Chair: So, Pay.UK has not yet even procured the system to implement this for the deadline of 7 October?
Chris Hemsley: That is correct but they are midway through that process.
Aidene Walsh: If I might give some assurance; this was one of the questions the board asked in terms of looking at that date of 7 October, and one of our board members did sit with Chris’s team and ascertain whether, in the absence of a system, there would be a process that could support the reimbursements going live on 7 October. We did get assurance that if this case management system is not up and running, a manual process can be put in place that will support reimbursement going live on that date.
Q176 Chair: This Committee has been very concerned about the potential conflict of interest for Pay.UK, which is a bank-led organisation, and we called for you to take a much greater oversight of this and responsibility for implementing this change. These banks, by the way, continue to lobby Committee members about how they do not want to implement this, nor are they required to do so, and give the impression they would rather the responsibility was given to social media companies. You are now saying they have not even procured the system?
Chris Hemsley: They are in the process. They have not signed a contract with a supplier, but they are well advanced in that system. On the point about assurance around the wider framework: we listened very carefully to the challenge this Committee gave about a year ago, and the proposal we set out in October confirmed we are using our legal powers to direct Pay.UK to make sure they have to implement these rule changes and to also use those powers for all the payment firms that use faster payments. So everyone who needs to act is backed by the legal powers we have.
Q177 Chair: What are your legal powers if someone does not meet the 7 October deadline?
Chris Hemsley: We have issued what we call a direction, a legal direction. If people fail to comply with our directions we, as you would expect, have an escalated process of monitoring compliance and then ultimately enforcement action. Our sanctions can include financial penalties, and they can be as large as 10% of turnover, so we have an effective toolkit to secure compliance. Of course, as any regulator would, we take a graduated approach to compliance depending on what the harm is and the circumstances.
Q178 Chair: Okay, so it is January now. Can I put on the record that we would like to request a written update from you in early May on this process and reassurance that this system has been procured and is going to be ready to implement?
Chris Hemsley: I am very happy to do that.
Q179 Chair: Thank you very much. Now, moving on from authorised push payment fraud, if you scan the horizon for all the other kinds of attempted fraud in our payment system, the UK, I think it is right to say, has been very much at the leading edge in terms of tackling this and our payment system is very advanced. What are you seeing on the horizon as something we ought to be concerned about?
Aidene Walsh: Can I just clarify, are you talking about fraud or wider horizon scanning?
Chair: Fraud in the payment system.
Aidene Walsh: Chris, do you maybe want to cover fraud?
Chris Hemsley: Yes, so in terms of fraud, it is a significant challenge. If I was calling out some things we are particularly focused on at the moment, we need of course to get the incentives in place to manage APP fraud within the financial system, so there is a lot of activity there.
In terms of where next, we increasingly need to bring other actors and people who can help tackle fraud into the wider framework and that is where you start to look at social media and telecoms firms. It is really helpful that the Government’s recent fraud charter extended those voluntary requirements into social media. For our part, within our powers we can use transparency; we want to have greater levels of transparency around fraud origination because, while we have seen some information on this, I would like to be much more specific about which platforms are a problem. That is the direction of travel, to try to make sure we are tackling the current problem of APP fraud.
In terms of the horizon, one thing I would highlight is that artificial intelligence and generative AI, for example, are creating new fraud opportunities, or fraud tactics, really. They are making it easier to impersonate voice and even appearance. This is the latest example of how criminals will unfortunately adapt and use the latest techniques to commit these crimes, which then lays the challenge at all our doors as a wider ecosystem to make sure we keep learning, adapting, and changing to keep pace. I would call that one out in the fraud space as a particular current concern.
Q180 Chair: And the board more generally, in terms of risks to the payment system?
Aidene Walsh: General risks?
Chair: Yes.
Aidene Walsh: In terms of general risks, clearly one of the key risks we have at this point in time is around the New Payments Architecture, so looking at the future of that, which we can discuss in a bit more detail if you would like. We have also called out artificial intelligence and the big tech prominence in payments and how that starts to evolve.
Then, on other payment systems, looking at international and global developments. There are potential new payments on the horizon and we are keeping a very watchful eye, whether that is around distributed ledger technology or whatever is starting to evolve. We have a team looking at aspects such as whether there will be a global system that supersedes any domestic payment systems.
Q181 Chair: Are you ready for a central bank digital currency?
Chris Hemsley: Yes, we have been working very closely with both the Treasury and the Bank, and we responded to the recent public consultation. There is clearly a lot of work to do on the detail and a key thing we pointed out was that there are some potential benefits here; a new stand-alone way of making payments could have resilience benefits and inclusion benefits. But we need to make sure that however it is implemented, we have appropriate confidence that consumer protection will be in place and that there will be good procedures, like we have in open banking, to share data in ways that consumers value. As I say, there is a lot of work to do on that, but we are definitely working very closely with both the Treasury and the Bank.
Chair: Thank you. Thérèse?
Q182 Dr Coffey: Going back to APP, you put out a statement recently about the limit, as it were. On the one hand if somebody’s bank goes bust they get a maximum of £85,000 reimbursed; on the other hand, the Financial Ombudsman Service has an award limit of £415,000. There have been suggestions that APP fraud reimbursement should be limitless: that people are subject to a crime and there has not been enough protection en route. Have you ended up pleasing almost nobody on where you have put the cap? Because on the other hand, some of the smaller firms—and it is good to have new entrants into this market—are basically saying the risks now mean they could be put out of business.
Chris Hemsley: You are absolutely right. This is one of the areas where we had to weigh up a number of different factors and it is familiar ground for regulators in this sort of space that sometimes not everyone agrees with what we do, on both sides of the argument. We did think about having no limit because that would be the most pro-consumer version of this, but we were mindful of the fact that small firms might see quite a small probability of what could be an uncapped liability. That uncapped liability could be very large indeed, particularly if those arrangements were applying in CHAPS, the high-value payment system. We thought we needed to introduce a cap to strike that balance between consumers and also consumers’ longer-term interest in terms of competition, fintech entry, things like that.
Once we decided we needed a cap, we did look at a potential range of options including the FSCS limit of £85,000 and the £415,000. We favoured the £415,000 for a number of reasons: it is the limit that applies to financial services and consumer protection; it applies to payments; and it applies to fraud generally. So it is the limit that a combination of Parliament and the FCA have set as being the appropriate cap on claims against financial services firms. There are some benefits there: it keeps things simple; it avoids too many cases going to FOS, which has cost and delays consequences; but more fundamentally we wanted to offer protection to people from these frauds at a high level, and we wanted to get the incentives in there. So by setting it at £415,000, we are covering most fraud cases. A handful of cases fall above that threshold and of course if you do fall above that threshold you still benefit from the £415,000.
It is a really difficult balance, and it is one of those areas where we are striking new ground in terms of bringing forward these proposals. We have to balance some competing pressures but we think we have done that in a reasonable way.
Aidene Walsh: Could I just jump in on the fintech aspect? From our perspective, we are working very closely with some trade associations who have fintech support of their membership. It is very much our view that, in building a business, understanding your AML and knowing your customer is an absolutely fundamental part of having a successful business going forward. When you look at some of the information produced—I think it was late last year—you can see there were a number of mule accounts set up within fintechs.
Q183 Dr Coffey: A number of what, sorry?
Aidene Walsh: Mule accounts, so actually starting to promote, essentially, proceeds of crime. We are working very closely to go through the expectations with fintechs but, to me, it is fundamental that if you are building a payments business you should know who your customers are and you should know whether those are mule accounts that are set up within your business walls.
Q184 Dr Coffey: I am conscious that industry has suggested it is only 0.3% of cases that are above £85,000 so it seems a disproportionate limit on smaller new entrants. At the same time, we are seeing some larger banks, which we will be investigating elsewhere, collapsing access to cash and other things for customers in a ready way. Traditionally, to try to counter that fraud, you would often have to go into a branch if you were transferring over a certain amount.
Aidene Walsh: Chris, you could maybe talk about some of the ways of actually mitigating that £415,000?
Chris Hemsley: Of course, by having good fraud controls, you mitigate the risk but also, most people, for most accounts, have limits that are usually in the low tens of thousands; I cannot transfer more than £25,000 from my current account and that is quite common, so we do need to put this in perspective. What we are saying is that if you want to run a business where you allow very large sums of money to move around very quickly, your fraud controls need to be matching that challenge. For most businesses, including most fintechs, I am not aware they would routinely be transferring those large sums around.
Q185 Stephen Hammond: Our clerks and I have been looking at some of the tables you have produced with 2022 data. There are some interesting trends and variations. If I look at “Metric A: Percentage of reported APP fraud losses refunded by volume”, you see that TSB, both in value and volume, is a long way ahead. The surprise is that many of the major banks are all bunched quite closely together, relatively speaking, but there are some outliers, like Monzo at the bottom, that were significantly lower both in terms of value and volume than even a number of their competitors in that new entrants space. The question is, how surprised were you at the variation? What has your reaction been to that, and what are you doing about the relatively low reimbursement rate at some of these proprietors?
Chris Hemsley: We knew there was a problem around the variation in practice across firms. It is something we had been concerned about for a while, but that was the first time we collected the data and published it. It helps to shine a light on the fact that there is this variation. Of course, some firms you mentioned that are towards the top, the right end of the table, have chosen to sign up to the voluntary Contingent Reimbursement Model—the voluntary protection arrangements—and TSB at the top had its own fraud guarantee. What we are seeing here is a range of different commercial approaches to protecting customers and in part that is the problem; it relies on it being voluntary, which is why the principal solution to this challenge is to have common minimum standards and to put those in rules so everyone has to comply with them.
Q186 Stephen Hammond: Even with those common minimum standards? If I read the Metric A charts correctly, a Monzo customer only has a one in five chance of being refunded if they are a victim of fraud?
Chris Hemsley: Yes, but you could expect that number to change quite significantly when the rules come in in October.
Q187 Stephen Hammond: That is 2022 data. Have you looked at any early data on 2023? Is it showing a similar trend that it will only change after October or are we already seeing a change in these statistics?
Chris Hemsley: I have not seen any more recent data. We are in the process of collecting the calendar year 2023 data, and we have committed to publishing that in, I think, June of this year, so you will see that number change. We think this is working. It is not a perfect, silver bullet solution to the problem, but firms have told me they are paying attention to these tables and that conversations within firms have been prompted around how they might improve their position. It is something we are really proud of and part of our package of measures, but ultimately putting in the minimum standards of protection backed by enforcement action will move it up a lot.
Q188 Stephen Hammond: As a Monzo customer, I will have a better than 20% chance in future?
Chris Hemsley: At least you know that now.
Q189 Stephen Hammond: If I look at one of your other metrics, which is “Metric C: Value of APP fraud received per million transactions”, several things stand out. You have the information for non-directed and directed PSPs. First, in terms of the non-directed, again huge variation for, what, 1 million transactions? And was it Dring finance, way above anyone else in terms of that?
Chair: Zing, is it?
Chris Hemsley: Dzing.
Stephen Hammond: Dzing, sorry. Dzing Finance, 187,695 per million. JPMorgan/Chase, 430 per million. I wondered what you think the explanations are, what was happening there, what regulatory response or what conversations you have had with them and what the response has been?
Chris Hemsley: Just in terms of context, we share this data. Indeed, we shared earlier versions of this data with the Financial Conduct Authority that is responsible for regulating the individual firms for these matters. So it has taken a range of steps with firms, but particularly Dzing Finance. The FCA has acted against that firm and has entered into, essentially, an agreement that it will not be signing up any new customers, so I think that is a clear public illustration that these matters are serious and that the FCA is willing to act. But the FCA has been acting to raise standards of performance across the board informed by the data we have shared with it. That is a specific example of a more general thing that the FCA does.
Q190 Stephen Hammond: On this particular metric, the other thing that stands out is not just the variation in the non-directed PSPs, but the variation between the directed and the non-directed PSPs. I wonder if you could give some explanation for that; is that partly because the larger banks just have better controls in place, or is there something else we should be looking at?
Chris Hemsley: The one thing which is important context is that—and I know you are not doing this—you cannot quite compare them like for like because of the way we have collected the data from the directed. But I think even that aside—
Stephen Hammond: If you look at the groups, there is quite an outstanding movement.
Chris Hemsley: There is, yes. It is probably showing you that some firms have more mature, more sophisticated, fraud prevention controls and some firms are further down that journey. Firms that have started to offer these protections for their customers are also investing more in fraud prevention, and we want to raise the standard to that best in class.
Q191 Stephen Hammond: So are you saying to us, therefore, those who have further to go on that journey are going to be pushed by what you are introducing in October, or is it the FCA that needs to do that pushing to bring them up to that standard?
Chris Hemsley: It is both. It is really important to get the incentives in place because that encourages commercial decisions about discretionary investment in fraud and customer protection, but the FCA has rules on things like money laundering and mule accounts, so that supervisory relationship informed by evidence, including from us, has that twin-track strategy. They both have their relative strengths, and so it is important we proceed with both routes.
Q192 Stephen Hammond: Finally, on your other metric, which is on the volume of APP fraud sent by per million transactions, Monzo stands out. In fact, Monzo, Starling, and Metro to a certain extent, but Monzo certainly stands out as an outlier in terms of the number of fraudulent customer transactions that are taking place. When you look at the other data, the highest fraud by value is TSB, that makes quite a virtue and has shown up well in terms of repayment. I wondered if there was anything you can draw from that? As they are going to pay people back, are they not taking such a careful attitude on where the fraud is originating from? Why is there, again, a big variation between some newer entrants as opposed to the older entrants? Are we saying we need to move a long way with their preventative controls?
Chris Hemsley: On the first, I would definitely agree. You can see that those towards the bottom, the wrong end of the table, have further to go, and we do need them to invest more in prevention methods and controls. I do not know enough to comment on the detail of Metro, for example. Sorry, it was Monzo you were asking about.
Chair: I think the top four are Metro, TSB, Starling and Monzo.
Q193 Stephen Hammond: The point I was making, as we made in the previous set of questions about these metrics, is there seems to be a gap between newer entrants and more established entrants. What are you doing, along with, potentially, the FCA, to make sure that the newer entrants are at as high a standard for customer protection?
Chris Hemsley: That is what we are all working towards. There is a difference, but the incentives on these parties are not yet there. That is what we want to put in to make sure it is the same standard of protection, a bit like health and safety regulations or food hygiene: that minimum standard of protection which then provides the same commercial incentives to all firms to invest in these important controls.
When the FCA is authorising firms, there are, of course, minimum standards that it already looks for, and then it works with firms to improve their risk management, which is a sensible approach. There is no gap or difference between the FCA and PSR on this. We are both using different approaches that are complementary to raise standards to the acceptable level, but you are calling out the difference in outcome for victims which is what we want to get out of this system to improve outcomes.
Q194 Stephen Hammond: When you look at the tables for 2025, given what is happening, are you expecting to see the variation more or less nil: everybody at a similar standard of high?
Chris Hemsley: It should be much more similar and much higher on average. You would expect the reimbursement rates in particular to be trending towards the top of that table.
Q195 Keir Mather: I just wanted to turn to the new CHAPS reimbursement scheme and begin by asking if you could provide us with a general update on the progress that you have made with the Bank of England to mirror your authorised push payment fraud scheme for the CHAPS payment system.
Chris Hemsley: It is really welcome that the Bank of England is working with us to roll out equivalent protections on CHAPS. I was speaking to Victoria Cleland at the Bank of England last week about this; we are working really closely with them. We are expecting to finalise our decisions and the legal instruments that we need to set out in order to support that roll out which is likely to mirror the directions that we have placed on participants to comply with the rules in faster payments. It would be a similar arrangement, so we would be directing firms to comply with the rule book in CHAPS in respect of authorised push payment fraud. That is how we will implement it. Some operational details might be a bit different because CHAPS is a different system run by the Bank of England, but we are working through all those details. We are hoping the protections will go live either at a similar time or shortly thereafter, but that is one of the things we need to work through.
Q196 Keir Mather: In regard to figuring out the details of those legal instruments based off giving that direction as to the role that you will play, could you just provide a clearer distinction of what exactly that role is with firms that use CHAPS and what role the Bank will have to play, especially in this post-consultation phase?
Chris Hemsley: This part of the Bank can be thought of as a payment system operator. So, it runs CHAPS as a payment system operator; it is analogous to Pay.UK in that respect. It is responsible for procuring and upgrading the infrastructure, and it sets the rule book. The Bank of England, as that payment system operator, would be making and implementing those rule changes.
We are not going to, and we actually cannot, use our powers of direction against the Bank of England. It is not something that legally exists, but we do not need to because the Bank of England has announced its agreement to make these changes. That is one of the most significant differences, but the shared objective between the two organisations is to get the equivalent level of protection, keep it as simple as we can to keep the rules and approach very similar. Of course, there are some differences in how it might be operationalised, but the main difference is that the payment system operator is actually the Bank of England rather than Pay.UK.
Q197 Keir Mather: When so much responsibility sits with the Bank, and you cannot give the Bank direction, could you explain to me why it is your responsibility to give a direction to firms that will be using a system that you will not be able to directly oversee?
Chris Hemsley: The legislation does not allow us to direct the Bank of England, which is perfectly sensible given the two respective roles. Also, CHAPS is set up in a way that there is a contractual relationship between the Bank of England and its participants. Therefore, the quickest way of implementing these new arrangements in a way that secures compliance and turns on that tool kit that I was talking about, including those powers to fine, is for the PSR to use its powers. This is us working with the Bank on the quickest, easiest, most pragmatic way forward, and that is the route we have identified as the quickest way of securing compliance.
Q198 Keir Mather: To dig into the feedback that you received from your consultation, was it different when respondents were addressing CHAPS rather than the faster payment system? What was the contrast between them?
Chris Hemsley: I do not recall a significant difference, actually. One of the debates, which we were talking about earlier, was the arguments around having a cap. Not having a cap in CHAPS brings in the prospect of potentially billions of pounds of unlimited liability. With an eye to that and the benefits of consistency between the schemes, that is one of the arguments that I recall where CHAPS is different. Other than that, we are putting quite a premium in our decision-making on keeping consistency between the two because it is not always obvious to an individual customer why there should be a difference between those two schemes.
Q199 Keir Mather: Given that you have already run the consultation process on the issue of authorised push payment fraud for faster payments and learned the lessons from that consultation, do you think, based on that, we can expect to see a much shorter implementation period between consultation and delivery for a CHAPS scheme?
Chris Hemsley: The answer to that is probably yes. Some of the system I was talking about earlier may well be the same system. Our legal directions also have to go through certain time periods of consultation, so we need to be mindful of that, but there is still an opportunity for us to catch up and ideally meet the October date. It may be a bit after that, but we are working hard to make sure that they both go live as soon as possible.
Q200 Dame Angela Eagle: I want to ask some questions about card payment fees, which is an often hidden bit of the cost of doing transactions like this. The Payment Systems Regulator is proposing an initial time-limited cap of 0.2% for UK-European Economic Area consumer debit transactions, and 0.3% for consumer credit transactions. When will this cap likely be proposed?
Chris Hemsley: It is important to say for the record that it is out for consultation at the moment. So if we were to confirm the position that we set out in our interim findings report late last year, we would be issuing our legal directions probably towards the end of this calendar year and then businesses would start benefitting from the prices probably in about a year’s time. So, this implementation and consultation period does take some time to get through.
Q201 Dame Angela Eagle: Why does it take so long?
Chris Hemsley: These are important matters. We have gone through a lot of evidence and we have set out quite significant proposals for both an enduring price cap arrangement for these fees and then this interim which you have talked about. We need to make sure that our process and evidence are robust, and robust to challenge.
Q202 Dame Angela Eagle: We are talking about challenge from Visa and Mastercard, the two organisations that dominate the market in this space. Is that why you are being so thorough in the answers that you are giving me?
Chris Hemsley: Yes.
Q203 Dame Angela Eagle: And taking two years to come to an arrangement for getting fees back to something similar to what they were when we were in the EU?
Chris Hemsley: Yes, I am being careful and thorough because it is really important that we are. In response to your question, any affected party could challenge the decision, which would include Visa and Mastercard, but potentially other issuing banks as well. These are important matters that we are tackling here: we are talking around £150 million to £200 million worth of extra costs to businesses a year. So, we do need to be careful, but we have also been going as quickly as we reasonably can through this process, and, as you would expect, parties ask for more time at every stage, and we resist or grant those only when reasonable; these are complex matters.
Q204 Dame Angela Eagle: For the record, what is the arrangement currently in place? Because it is taking you two years to get to a cap. We know what you have proposed that cap to be, but we do not know what it is actually going to be by the time you get through the whole process, do we?
Chris Hemsley: We have proposed an intro cap of 0.2% and 0.3%, which, as you said, would take us back to the levels that existed before we left the European Union. Those numbers are essentially fivefold: there was a fivefold increase in those prices.
Q205 Dame Angela Eagle: Yes, to 1.15% and—
Chris Hemsley: 1.15% and 1.3%.
Q206 Dame Angela Eagle: For no apparent reason that anyone could discover except that they felt they could.
Chris Hemsley: This is the challenge we were dealing with. When we left the European Union, the legal commitments that existed fell away.
Q207 Dame Angela Eagle: So Visa and Mastercard hoicked up the price to a quite astonishing amount very quickly. It did not take them two years to consult on it, did it?
Chris Hemsley: No, but we started our work within weeks of those prices being increased.
Q208 Dame Angela Eagle: For the record, what are the prices that are in place now while the consultation period is going on?
Chris Hemsley: The prices are—
Aidene Walsh: I understand, but I think the best thing to do is for us to absolutely clarify. I think it is in the region of 1.15% and 1.3%. Essentially, what happened when Brexit occurred was that the UK was put into the rest of world bucket in terms of the interchange fees, and we are looking to push that back to a separate bucket.
Q209 Dame Angela Eagle: Yes. We have a Government who do standard 12-week consultations on issues that are quite important, sometimes over Christmas or holidays, and yet it is taking you two years. Meanwhile the companies that hiked up the prices to that extent are raking in the added fees while you are advancing at a snail’s pace on your consultation. Why can the Government do a consultation for 12 weeks, and it takes you two years?
Chris Hemsley: We need to collect evidence and obviously respect the legal rights of the parties as part of this intervention. The Government have a different toolkit and sometimes have powers they can exercise more quickly, or they can bring forward proposals for legislative change. These sorts of investigations do take time. We have been sifting through thousands of documents.
Q210 Dame Angela Eagle: Frankly, they are not going to help you because they are coining it in with their higher fees while you are busy trying to ask them for information that will actually take the fees down. They are not going to be very forthcoming with it, are they, as the evidence you have given us shows. They keep changing the people that are responsible for working with you; there is delay after delay after delay. Well, they would, wouldn’t they?
Chris Hemsley: Absolutely. When you go into these investigations you expect people to protect their rights, that is what they are allowed to do, so right from the start—
Q211 Dame Angela Eagle: Are they taking the mickey as well as protecting their rights?
Chris Hemsley: We have used our formal powers right from the start. All our information requests have been backed by our legal powers. That does push us down a certain route, which means that there is a lot of discussion around detail and compliance, but we have used those formal powers right from the start because we are very mindful of the potential for that behaviour.
Q212 Dr Coffey: Are there more powers that you would like, then?
Chris Hemsley: Yes, there is one area where there is an opportunity to introduce reform. When we ask for information, if a party refuses to give us that information, we would take them to court. If they gave us that information on the steps of the court, or just before we were in court, we have the information and there is then no consequence. Let us be clear, Visa and Mastercard have not done this, but it has highlighted that other regulators have the ability, in those sorts of situations, to consider whether a financial penalty might be appropriate. So, there is a gap in that sense. I am not sure that it has slowed us down—
Q213 Dr Coffey: Have you asked Treasury for it?
Chris Hemsley: I have certainly spoken to Government officials about it. I would prefer to confirm what we have asked for.
Q214 Dame Angela Eagle: Perhaps you could write to us about that?
Chris Hemsley: Yes, I am very happy to.
Q215 Dame Angela Eagle: Can you see that if you are a user of these financial products having to pay these extra high prices, it might be quite frustrating? I understand why you are walking on eggshells, because you are basically being taken as far as possible by the companies that want to maintain their current price levels which are stopping you from imposing your cap, which is much lower, and you have now told us it is going to take at least two years by the time you get round to opposing it. Do you not think that, as a regulator, you should have a much tougher suite of powers to do a consultation, to enforce and require the information that is needed for you to do that in a much faster way than this? Because the customer and the people that are paying these much-hiked fees are just being taken for a ride by the companies, are they not?
Chris Hemsley: I absolutely understand the frustration and that is one of the reasons why we took this work on as quickly as we could.
Q216 Dame Angela Eagle: It seems like quite a snail’s pace to me, if you do not mind me saying so. I know you started it quickly, but it is not proceeding very quickly, is it?
Chris Hemsley: It is proceeding as quickly as we feel able to. One of the things I would highlight is that when we started to request the information from the firms, it became readily apparent that they do not hold information in a way that is readily accessible for us.
Q217 Dame Angela Eagle: Frankly, they had enough information to hoick their fees in about 24 hours after we came out of the European Union and that protection we had enjoyed—if perhaps had been taken for granted—disappeared. They hoicked their fees up really quickly, and now they are telling you they do not have the information that you require to justify the fee increase. Somebody in there must know it because they acted very quickly to increase prices.
Chris Hemsley: In our interim findings, we have set out our view very clearly: that this market is not working sufficiently well.
Q218 Dame Angela Eagle: It is working sufficiently well for the card issuers, but not for the consumers and the users, is it?
Chris Hemsley: I agree 100%; that is exactly what we have set out: it is not working sufficiently well for businesses, end users, or consumers, and that is why we have set out these proposals.
Q219 Dame Angela Eagle: Perhaps you should contact the Competition and Markets Authority and request it does a review faster than your two-year consultation.
Chris Hemsley: We are now well advanced in this work; it does take time. Any organisation doing this sort of work typically takes quite a lot of time given the information needed.
Q220 Dame Angela Eagle: It is all very cosy and convenient for the people increasing the fees and then saying they do not have the information to give you to justify why they increased the fees. Do you have the power to place a temporary price cap on these fees while you do the consultation? Perhaps if you put it at 2% and 3%—which is what it was before and clearly can work—that may give them some incentive to cough up the information. Why have you not done that?
Chris Hemsley: That is what we have proposed: to revert the fees to their pre-Brexit levels while we are going through the frankly quite time-consuming work of establishing a longer-term cap.
Q221 Dame Angela Eagle: Why do you not do that?
Chris Hemsley: The proposal we have set out is to use our powers.
Q222 Dame Angela Eagle: When are you going to do it?
Chris Hemsley: We have a consultation open. The next step is to confirm our final proposals, and, shortly thereafter, we will issue our legal instruments assuming we have not changed our position.
Q223 Dame Angela Eagle: You are talking to me with a very big eye on a very rich lawyer who works for Visa or Mastercard, are you not?
Aidene Walsh: The final proposal is coming out in April.
Q224 Dame Angela Eagle: Are we going to get a temporary cap in April to encourage these companies to fess up with the information so you can do the job you are trying to do?
Chris Hemsley: I will try to be clear; I am choosing my words carefully because we are in the middle of a consultation.
Q225 Dame Angela Eagle: I know, and some very rich lawyers are probably watching your every breath in and out. However, you are the regulator.
Dr Coffey: You have parliamentary privilege when giving evidence to a Committee.
Chris Hemsley: I am certainly not hiding anything; I am trying to be really clear about where we are. We have set out our interim findings for consultation, which include improved information and that move to a longer-term price cap and an interim price cap as soon as we can implement it. We will look at the evidence that inevitably will come forward. If nothing changes, those will be our proposals.
Q226 Dame Angela Eagle: When is the soonest you could put an interim price cap on to come to a more sustainable solution while you are doing the longer-term work? Why can you not do it tomorrow? These prices were available and were used until we left the European Union; they are clearly not a disaster from a business point of view or these companies would have been in trouble much earlier. Why can you not say, “We are going to impose a cap of 2% and 3% to protect customers until we finish the consultation”?
Chris Hemsley: We have gone through exactly that logic to work out the best way.
Q227 Dame Angela Eagle: How long is it taking to impose the cap? They are coining it in with much higher fees while all this dillydallying is going on.
Chris Hemsley: The soonest we will be able to set out the legal instruments to implement that cap would be around the summer of this year.
Chair: We have gone from April to summer now.
Q228 Dame Angela Eagle: Why so long? It was April a minute ago, and now it is summer.
Aidene Walsh: April is the final proposal.
Q229 Dame Angela Eagle: Why can you not use your powers to impose a cap while you do the work to take the situation to what it was before and protect consumers? Do you have the power to do that?
Chris Hemsley: We have the power to do it. We have to follow the general principles of public law, so we have to set out our evidence and we have to consult. When we use our legal power—these instruments—there are necessary consultation processes we go through. So we are bound by public law, and with good reason; you need regulators to face checks and balances. But when you want to move quickly, inevitably there is frustration that sometimes you have to go through these processes in order to effect change; that is the situation we are in.
Q230 Dame Angela Eagle: The companies are running rings around you; maybe Parliament should have strengthened your powers so you could have done this quickly. I do not understand why you cannot just put a cap on now, so things are as they were before, and then do the work. In those circumstances, if they were not earning the extra money from fees they are now being allowed to earn for at least two years, they might have come up with the information for you to do the work much faster.
At the moment, there is an incentive for them to carry on not giving you information for as long as possible because they are coining it in. Where is the public law principle in that?
Chris Hemsley: That is why we have moved quickly, and we are moving through this, but we need to move both quickly—
Q231 Dame Angela Eagle: Your definition of quickly is a very peculiar dictionary definition to what most ordinary people would call quickly. Two years is not quickly.
Aidene Walsh: It is possibly useful for you to talk about the go-forward approach in terms of supervision.
Chris Hemsley: To make sure we have routinely better information available we have set up a new team within the PSR to supervise payment system operators—which includes Visa, Mastercard, Pay.UK, and LINK—so they can provide it to us on a much more useful basis than in the past. Frankly, Visa and Mastercard have not been regulated in this way in the past, and it unfortunately takes time to take them on that journey.
Dame Angela Eagle: They are earning a very nice little profit while you are taking all that time to do it.
Q232 Chair: In your annual report and accounts, you say you have, “Dedicated considerable resource to a legal challenge, the outcome of which is awaited,” and you had to spend a further £1 million from your reserves because of this open claim. Was this linked to what we have just been discussing? Can you tell us what that legal claim is, under the parliamentary privilege you are enjoying today?
Chris Hemsley: Absolutely. It is all completed now and is part of the public record. That was a legal challenge taken by NoteMachine against one of our decisions. NoteMachine is an independent provider of ATMs, and it essentially disagreed with the prices it received for providing those ATMs. It complained to us, we took a number of decisions, it challenged those decisions in court, and the High Court agreed with our position.
Chair: That leads very nicely into Anne Marie’s section.
Q233 Anne Marie Morris: Oh dear, the ATM network and cash machines. You issued Specific Direction 12 in March 2022, which was intended to try to put direction policies in place to ensure our free-to-use ATMs remain. How successful has that been, and how are you monitoring that to see whether there are still an increasing number of closures, bearing in mind the recent Government diktat about defined radius miles to access a cash machine?
Chris Hemsley: At a national level, we have good coverage of free-to-use ATMs: over 99% of people have a free-to-use way of accessing cash within three miles. That misses some important detail on the ground: there will be communities who do not recognise that and do not feel that reality, which is why there are other ways of addressing those issues. For example, through community provision, or where there are areas of vulnerability.
Q234 Anne Marie Morris: Am I right in thinking the Government drew a distinction between urban and rural, and the three miles applies to one but not the other? Are you tracking both? That would make quite a big difference. Are we measuring distance as the crow flies? In rural communities, that is completely hopeless.
Chris Hemsley: We have moved to joint monitoring with the Financial Conduct Authority, which will have a lead role in this area going forward. The figure for one urban mile is 95%, and that has historically been measured as the crow flies. As we get smarter and make better use of data, we will get better at doing that. That is why we never solely relied on these simplistic metrics. LINK installs machines where a river is in the way, or there is a motorway, or something that does not come out of those simplistic measures.
To answer your earlier question, LINK is doing a good job in this area. It has taken a mixed approach in terms of relying on those top-level metrics, but also responding to community requests to plug the gaps in the map and do things communities need. I am really looking forward to the next step, where the Financial Conduct Authority will be able to join up the free-to-use ATM network with bank branches, post offices, and other ways of getting and depositing cash.
Q235 Anne Marie Morris: Who regulates is irrelevant to the consumer on the ground; they want to know they can get access. You have agreed with me that the current idea of measuring it as the crow flies does not really work. As the regulator, are you going to be reviewing these criteria again? That may mean liaising with the Government and the FCA to look at those communities who use more cash, who tend to be rural and coastal, and looking at the crow flies issue, which clearly does not work in rural areas, to come up with some guidance that works to ensure communities have access to ATMs.
Chris Hemsley: We have always had more of a portfolio approach; you have the reliance on the metrics and data, but it is supplemented by the reality on the ground, including the fact that travel distances will be very different. The FCA is consulting at the moment and is in the process of developing its guidance, so I do not want to try to speculate and speak on that, and I know you are meeting representatives very soon. I fully expect a feature of the arrangements going forward will be a rounded approach, combining data where we have it and where it is really useful, but also accepting the reality on the ground will always be more complicated.
Q236 Anne Marie Morris: Consumers see two types of ATMs: those which are effectively commercial—the ones you see in supermarkets, which effectively are subsidised by the supermarket—and those in the scheme that ensures there will be a hole in the wall, if I can put it like that, within the three-mile and one-mile radius. Are you seeing an overall fall in the number of protected ATMs alongside those where an individual shop decides it makes a nice little earner by putting in a cash machine and is happy to pay the interchange fee? That seems to be the perception. There was a petition recently that said there was a huge fall, which does not accord with the statistics you have just set out, Aidene.
Chris Hemsley: The key distinction is machines that are free-to-use and those that are pay-to-use. Many free-to-use ATMs are in our biggest supermarkets, which is a really important source of free access to cash. It is important to note we do not count the pay-to-use ones; all the analysis I have talked about is around free-to-use ATMs.
In terms of those trends, both free-to-use and pay-to-use are reducing over time, but that is not affecting coverage. For example, a supermarket might have had two or three machines and it is consolidating to one. That still provides that important access point, but that is one of the bigger trends. We have seen a thinning out of the estate, removing some cost, which ultimately has to be paid for by removing the duplicative machines in the same location or very nearby. We really need to build on that portfolio approach as a more diverse way of solving this problem and focus on whether you can get cash from free-to-use ATMs, the post office, tills, and shops.
Q237 Anne Marie Morris: The interchange fee has clearly been one of the challenges and NoteMachine is particularly irritated by this. What steps are you taking to deal with the low-volume ATMs? There seems to be a move to try to make the interchange fee work better, whether we are trying to get, if you like, the balance between the free-to-use, the market rate, and then this in-between.
Chris Hemsley: I see it as a bit of a layered approach. We have the standard interchange fee—which is the payment to the provider that is for everyone—and then, in low-volume locations, there is quite a substantial extra payment on a per-pence basis. That is a commercial incentive to try to provide machines in locations that otherwise would need them but may not get them.
The next fallback is LINK procures a machine—not itself directly—to make sure it is in those protected locations. We try to get the market to solve most of the problem through the interchange fee, then you use a particular incentive for low-volume locations, but then, ultimately, the fallback is the direct provision by LINK if those other two mechanisms do not work.
Q238 Anne Marie Morris: How are you measuring whether that layered approach works and how many machines are under which scheme?
Chris Hemsley: We get regular reports from LINK, and then we have a process of annual reviews of compliance. Our legal direction—which you have referred to—places an obligation on LINK to protect the geographic access to free-to-use ATMs and gives it discretion on how it does it. We review annually, we consult with consumer groups and businesses if there are any issues, and then we essentially reach a view on whether LINK is doing enough. Our recent conclusion was it is doing a good job in meeting those requirements.
Q239 Anne Marie Morris: While there is an obligation to, if you like, meet the standard you have set, the challenge is they get the machines put in place, usually using Cash Access—or NoteMachine in a limited number of cases—but there are no timelines or KPIs.
I will give you a case in point: in one of my communities, LINK and Cash Access have agreed there should be a machine; we only have commercial machines. We have been waiting months and months to identify potentially one of the existing commercial outlets to convert to a free-to-use, but clearly there is a loss to the business in doing that, and it churns on and we do not get the free-to-use ATM we need. As the regulator, what are you going to put in place by way of KPIs or a better system to ensure what you want is brought to fruition?
Chris Hemsley: We have KPIs that we monitor and engage with LINK on around the speed with which it takes certain actions. Once it decides to put an ATM in, the local circumstances can cause delays because it needs to look for a site, as in the example you just cited. I do not know the details, but it would not be uncommon for a pay-to-use machine to be under a contract which has an endpoint. You then get to this point where LINK is trying to solve a local cash access problem, but it takes time to find a suitably secure location or to enter into the right contract.
Our job is to oversee LINK. If there are particular complaints about LINK’s role, and if it does not have good reasons for delay, we would look at that and consider taking further steps.
Q240 Anne Marie Morris: As a regulator, there are always going to be problems with finding sites and challenges of planning; you name it, you could throw a book at it, but that is not good enough for the consumer. There was a promise to the consumer there would be a free-to-use within the regulated distance, so it is not enough to just sit there and say, “Well, there are problems, and it takes LINK time to sort them out and find an appropriate site.”
Surely to goodness, as the regulator, you need to start looking at steps you can take to make sure this happens in a timely way because at the moment it does not. It may be things like planning, and you need to go back to the Government and say, “We need to have automatic planning.” It is never that simple; there are other things, but, as the regulator, surely your duty is to ensure we have this access. It is not good enough or acceptable to say, “It all depends on the local circumstances and you might have to wait months and years.”
Chris Hemsley: We need to make sure LINK does its job. If it does not have a sensible explanation and is not doing enough, we can definitely act on it. With cash access more generally, we are going to have a broader suite of tools because there can be local communities where it is difficult to find a suitable location for an ATM, but there could be a post office or a local shop that can provide cash. By opening up a wider portfolio of options—shared banking hubs being one I have not mentioned but should have—we can solve these problems at a local level much more effectively, and that will unlock real change.
Q241 Anne Marie Morris: Let us hope you are right, and I look forward to seeing how you and the FCA work together in this new world.
If you live in a tourist area like mine and you have fetes, events, air shows and so on that bring in an awful lot of tourists, there is no mechanism to ensure there is enough cash in the machines. In Teignmouth, one of my towns, the cash machine was dry, there was no cash; that is ridiculous. So I went to LINK and Cash Access and asked, “What can we do about this?” and they said, “Well, if you notify us at least three months in advance of this event, we can make sure the machines are filled up.” Sorry, surely to goodness it cannot be right that we are dependent on the local community to think, “Ah, yes, I have an air show; I must make sure I notify so there is enough cash in the machines.” As the local MP, I happen to know and can do that, but a lot of MPs do not. That sounds ridiculous.
Chris Hemsley: I agree with you. LINK has installed machines in towns with tourist influxes to support that, so it is something it does consider.
Q242 Anne Marie Morris: They need filling up, not just another machine; they need cash in them.
Chris Hemsley: No, absolutely. Part of this is about diversity because that will really help. That is quite a cost-effective way of addressing events; if different places in the local community can take cash in from those visitors and then distribute it out to those who want the cash, that is cost-effective, convenient, and it really works. Broadening out that toolkit will help us address some of these problems as well.
Q243 Chair: How vulnerable are we to the whole cash network going down or being hacked? Is it a central vulnerability?
Chris Hemsley: The Bank of England regulates the LINK system for financial resilience reasons, a role it takes extremely seriously. We work closely with it, but it is the Bank of England’s responsibility, and it goes into quite a lot of detail with LINK and a number of other firms, as you would expect.
Q244 Stephen Hammond: We all accept that having a reliable payment system free from fraud is key to an economy and to driving productivity. We have an increasingly global and digital economy, and yet the UK seems to be falling behind in terms of the next generation of real-time payment systems. The commentariat is suggesting we are now some way behind in systems, having previously been the global leader. Do you accept that view? As a regulator, what should or could you be doing about it?
Aidene Walsh: The recent Future of Payments Review called out that the UK has a lot of strength in terms of payments, but that it is at risk of falling behind. From a board perspective, we have challenged Chris and the team to engage a lot more with other international payment systems. The feedback we have had to date—particularly with things like open banking—is we are still up there in terms of leadership, but we are at risk of falling behind if we do not upgrade our payments infrastructure.
Chris Hemsley: We can do a lot with the current system, and we can make progress on things like app scams and open banking, but, ultimately, we need more investment and we want more capabilities. We want them to do more. Following the Future of Payments Review, the Government accepted that recommendation and announced their intention to have a National Payments Vision in the autumn statement but said there needed to be a consideration of the role of the new payments architecture. So that is the current plan; that is the programme to upgrade our interbank systems. Pay.UK has now paused that programme, which means the dates by which we wanted those upgrades to take place have moved back.
Q245 Stephen Hammond: I understand the procurement process has now been running for over seven years in terms of that national payments architecture. It is now paused. When do you think the new payments architecture is likely to be seen?
Chris Hemsley: The tender itself—the sharp end of the procurement process—was effectively completed this time last year, and then it went into a process of regulatory clearances in 2023. At the moment, we do not have a timetable for when the National Payments Vision might provide a route to unpausing the programme.
Q246 Stephen Hammond: As I understand it, you have been asked to support and contribute to that vision.
Chris Hemsley: Correct.
Q247 Stephen Hammond: Have you been given any clear instructions as to how long that vision development will take?
Chris Hemsley: The Government have not set out a timeline. We are all working on the assumption this needs to happen as quickly as possible, and we will be supporting the Government to do that. We are in regular discussions with Treasury in that regard.
Aidene Walsh: We are very alive to the fact that instant payment systems are not standing still across the globe. Seven or eight months have passed since the decision we took last year. We have to have a conversation about the resilience of faster payment systems and what resilience looks like, bearing in mind payment systems are evolving on a global basis. We need to work on a way through this very quickly and maybe look to decouple that as best we can from the delivery of a National Payments Vision.
Q248 Stephen Hammond: If you decouple, that will not allow the new payments architecture to come in earlier, will it?
Aidene Walsh: I cannot comment on that. We are working on a way forward.
Chris Hemsley: We cannot stop investing in the current system because it needs to be resilient, and we need to find the best way to upgrade. That is the key thing.
Q249 Stephen Hammond: Unless we move and keep in time with other developments internationally, we are going to find ourselves slipping back in terms of the demands of this economy.
Chris Hemsley: Absolutely. What we were trying to achieve through that programme still stands. We still want better data standards in the system to prevent fraud, and cheaper and easier ways for fintechs to connect to the system. We need to find the best way of unlocking those outcomes.
Aidene Walsh: The Future of Payments Review talked about open banking. Open banking is not standing still; we are putting a huge amount of pace into that. From our perspective, that will continue to evolve at pace.
Q250 Chair: Just a few quick fire questions to complete our session. In your annual report, you note your costs last year went over substantially; that sounds very worrying. I appreciate it is not a taxpayer cost, but to go over by 20% is not great budgeting. What went wrong there?
Chris Hemsley: We had a plan to grow our headcount to deliver our work plan. Coming out of the pandemic, our attrition increased; we were losing staff to other organisations. It is quite a lively recruitment market for payment specialists. While we were recruiting, we could not increase our headcount as quickly as we wanted, so we had a choice: either protect delivery using external consultants or move some of our deadlines back. We chose to protect delivery, but that came at a cost, which you are referring to. We then exited that, so that is not still in the organisation. Within about six months, we had—
Q251 Chair: So staffing has returned to normal now?
Chris Hemsley: Absolutely. We are carrying some vacancies, but nothing out of the ordinary.
Chair: The cost of your annual report—which is 193 pages long with 62 photos—struck me as being rather excessive. That may be an area where you could do something a little more economical, but I digress.
We as the Committee get the impression you are either not equipped with sufficient powers, or the companies you are regulating are able to effectively delay, procrastinate, or encourage you not to take action against them. I noticed also it was the FCA that took action on the Dzing case. Could you follow up this Committee session by sending us a letter outlining where you do not think your powers are strong enough, and what we should be recommending the Government do to strengthen your powers?
I am afraid it did come across today that you do not have the powers in a range of different areas that we in Parliament would want you to have. So there are a couple of things we will make sure you continue to keep us informed with, but thank you for your time today. I will bring the formal session to a close.